MITHYS：小心握手-保护移动设备免受SSL使用漏洞的影响
MITHYS: Mind The Hand You Shake - Protecting mobile devices from SSL usage vulnerabilities
摘要：
最近的研究表明，大量的移动应用程序，通常处理敏感数据，如银行帐户和登录凭据，遭受SSL漏洞。大多数情况下，这些漏洞是由于不正确使用SSL协议（特别是在其\emph{handshake}阶段），导致应用程序暴露于中间人攻击。在本文中，我们提出了MITHYS，一个系统能够：（i）检测应用程序容易受到中间人攻击，（ii）保护他们免受这些攻击。我们证明了我们的建议的可行性，通过在Android的原型实现，名为MITHYSApp。一组完整的实验评估我们的解决方案在检测和保护移动应用程序免受中间人攻击，而不引入显着的开销的有效性。最后，MITHYSApp不需要任何特殊权限或操作系统修改，因为它在应用程序级别运行。这些功能使MITHYSApp可以立即部署在庞大的用户群中。
英文摘要：
Recent studies have shown that a significant number of mobile applications, often handling sensitive data such as bank accounts and login credentials, suffers from SSL vulnerabilities. Most of the time, these vulnerabilities are due to improper use of the SSL protocol (in particular, in its \emph{handshake} phase), resulting in applications exposed to man-in-the-middle attacks. In this paper, we present MITHYS, a system able to: (i) detect applications vulnerable to man-in-the-middle attacks, and (ii) protect them against these attacks. We demonstrate the feasibility of our proposal by means of a prototype implementation in Android, named MITHYSApp. A thorough set of experiments assesses the validity of our solution in detecting and protecting mobile applications from man-in-the-middle attacks, without introducing significant overheads. Finally, MITHYSApp does not require any special permissions nor OS modifications, as it operates at the application level. These features make MITHYSApp immediately deployable on a large user base.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
